fix: security/bug fixes, extract constants, remove magic values

- Remove random suffix from Wellfound job IDs (broke dedup)
- Add null coalescing to all profile field returns in form_filler
- Fix honeypot case referencing nonexistent results.skipped counter
- Remove unused makeJobId import from linkedin.mjs
- Navigate directly to job URL instead of search+click in linkedin apply
- Add Telegram notification rate limiting (1.5s between sends)
- Replace Mode B blocking sleep with --preview flag
- Add max_applications_per_run enforcement
- Remove tracked search_config.json (keep .example.json only)
- Add search_config.json to .gitignore, fix duplicate node_modules entry
- Extract all magic numbers/strings to lib/constants.mjs

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

job_searcher.mjs

@@ -16,6 +16,7 @@ import { createBrowser } from './lib/browser.mjs';
 import { verifyLogin as liLogin, searchLinkedIn } from './lib/linkedin.mjs';
 import { verifyLogin as wfLogin, searchWellfound } from './lib/wellfound.mjs';
 import { sendTelegram, formatSearchSummary } from './lib/notify.mjs';
+import { DEFAULT_FIRST_RUN_DAYS } from './lib/constants.mjs';
 
 async function main() {
   console.log('🔍 claw-apply: Job Searcher starting\n');
@@ -26,7 +27,7 @@ async function main() {
 
   // First run detection: if queue is empty, use first_run_days lookback
   const isFirstRun = loadQueue().length === 0;
-  const lookbackDays = isFirstRun ? (searchConfig.first_run_days || 90) : null;
+  const lookbackDays = isFirstRun ? (searchConfig.first_run_days || DEFAULT_FIRST_RUN_DAYS) : null;
   if (isFirstRun) console.log(`📅 First run — looking back ${lookbackDays} days\n`);
 
   let totalAdded = 0;